Fail2ban may have a bug ...

Discussion in 'Installation/Configuration' started by keybd_user, Mar 13, 2015.

  1. keybd_user

    keybd_user Member

    Hi,

    I had a VM for testing purposes installed with ispconfig2 on a centos6 vps and it seems like after setting up the jails I was interested in fail2ban, (that is making a new jail.local file) postfix error messages show on the maillog saying postfix is trying to send messages to [email protected].
    What I have done was a copy of the jail.conf to jail.local.
    Simply:
    cd /etc/fail2ban
    and then:
    cp jail.conf jail.local

    and then enabled the services I want to check.

    Well I changed all of the dest tags that determine the destination email address to report the occurrences on each jail job that requires it.
    It seems, and I have seen this on the web, that many complain about fail2ban sending emails to [email protected], the default address on the file even when every single jail section on fail2ban.local is changed to the Correct Local email address.
    What have done is Change on All the fail2ban.con file the dest tags to the correct address. Reloaded fail2ban and it worked!
    No more errors sending email to [email protected].
    Also I have noticed that the emails happen at the start / reload of fail2ban .
    So that means it may be an issue with the Start of fail2ban were the First run on the setup is done for some reason on email addresses in the fail2ban.conf file rather then on the fail2ban.local as it should be.
    Just an heads up to everyone with the same problem.
    Btw I also had to restart the deamon, not just reload the with fail2ban-client reload.

    Regards.
     
    Last edited: Mar 13, 2015
  2. keybd_user

    keybd_user Member

    Hi,

    The problem is solved.
    Iit was not fail2ban sending more emails, the postfix emails i have seen were, after analising the logs, deferred email that simply was always being sent by post mail.
    I simple flushed the postfix bounce queue ... by issuing the following command all deferred email were wiped out.
    Email can be seen on : /var/spool/postifx/deferred
    and the command to clear those emails is:
    postsuper -d ALL deferred

    Regards,
     

Share This Page